LDP Connect Privacy and Security Policy

Effective date: 30.10.2026

1. Who we are and what this policy covers

LDP Connect is a staff softphone used by authorized LaDepozit personnel to handle work calls, view work contacts and call history, and manage availability. This policy covers the Android and iOS LDP Connect apps and the services that support them. It supplements LaDepozit’s general Privacy Policy (GDPR Policy), available at https://ladepozit.ro/politica-gdpr/, which continues to apply to customers, representatives of corporate clients, users of storage units and other data subjects. Where this policy does not address a matter specifically, the general GDPR Policy applies.

The data controller is OSIRIS INVESTMENT S.R.L., a Romanian legal entity registered with the Trade Register Office attached to the Bucharest Tribunal under no. J2019008391401 (EUID ROONRC.J2019008391401), sole registration code (CUI) 41318860, VAT number RO41318860, with its registered office at Str. Cristian Tell nr. 19, camera 2, etaj 1, ap. 5BIS, Sector 1, București, Romania („LaDepozit”, „the Controller”, „we” or „us”). LaDepozit complies with Regulation (EU) 2016/679 („GDPR”) and Law no. 190/2018.

2. Contact details

Data Protection Officer („DPO”): Buda Și Asociații S.P.A.R.L. (Buda Partners), represented by Attorney Ștefan Ionuț Buda. E-mail: privacy@ladepozit.ro.

All privacy questions, data subject requests, objections to call recording and reports of security incidents should be sent to privacy@ladepozit.ro.

General app support: contact@ladepozit.ro, telephone 0373 808 090.

3. Information we process

Depending on your use and permissions, we process:

Account and authentication information: name, work email, user and device identifiers, device name and platform, sign-in credentials and session tokens, and a verification code if two-factor authentication is enabled. If you choose Google sign-in, Google provides an authentication token used to verify your account.
Calls and voice: the audio you send and receive during a call; call recordings (see section 4); telephone numbers, caller and participant names when available, call identifiers, direction, status, time and duration, queue information, and related call and recording metadata.
Work directory and call context: contact names, telephone numbers, email addresses, language, linked customer information, marketing-preference information and other relevant context provided by LaDepozit’s systems.
Availability and service operation: agent settings, availability, endpoint registration, push notification tokens and notification-related information needed to route calls and missed-call alerts.
Technical and security information: device and network information such as IP address, session identifiers, access logs, diagnostic information and security events.

We receive information from you when you sign in and use the app; from LaDepozit’s staff and customer systems; from other call participants and our communications providers when calls are handled; and from Google when you choose Google sign-in. Contact and call information can concern customers or other people you communicate with, not only app users. The app is not designed to collect special categories of personal data; any such data incidentally disclosed by a caller during a call are protected and are not used for any separate purpose.

4. Call recording

Calls handled through LDP Connect are recorded in order to ensure and improve the quality of our services, to train staff, and to keep evidence of requests and agreements made by phone.

Callers are informed that the call is recorded through an automated voice message played at the beginning of the call, before the conversation begins. A caller who does not wish to be recorded may end the call and contact us in writing at privacy@ladepozit.ro instead. Staff using LDP Connect are informed of call recording through this policy and internal procedures.

Recordings are accessible only to designated authorized members of the LaDepozit team whose role requires access (for example, quality review, customer support supervision, or handling a complaint or dispute), based on role-based access rights and, where necessary for their duties, to the DPO in justified cases. Access to recordings is logged. Recordings are not used for purposes incompatible with those described above, and are not used for decisions based solely on automated processing.

Recordings are retained for up to [RETENTION PERIOD, e.g. 30 / 90] days and are then deleted automatically. A specific recording needed for a complaint, dispute, legal claim or a data subject request is preserved separately, with restricted access, only for the justified period.

5. Purposes and lawful bases

Operating the app for staff (accounts, authentication, call routing, availability, notifications): legitimate interest in organizing and running our customer-service operations (Art. 6(1)(f) GDPR) and performance of the employment or service relationship (Art. 6(1)(b) GDPR).
Handling calls with customers and other contacts, and displaying customer context: performance of a contract or steps taken at the data subject’s request before entering into a contract (Art. 6(1)(b) GDPR); responses to inquiries and customer support (Art. 6(1)(b) and (f) GDPR).
Call recording for service quality, staff training and evidence of telephone requests and agreements: legitimate interest (Art. 6(1)(f) GDPR). Participants are informed before the conversation starts and may choose another contact channel.
Security, access logs and diagnostics: legitimate interest in protecting our systems, users and data (Art. 6(1)(f) GDPR).
Compliance with legal obligations, including disclosures to competent authorities: Art. 6(1)(c) GDPR.

Where we rely on legitimate interest, the Controller has carried out a documented Legitimate Interest Assessment (LIA), a summary of which is available upon request at privacy@ladepozit.ro. Providing account information is required to use the app; without it, access cannot be granted.

6. Device permissions

The app requests microphone access for calls. If you deny it, you may be unable to participate in calls. It may request notifications to alert you to calls and missed calls; disabling them can prevent timely alerts. On Android it may request nearby devices/Bluetooth access to use compatible audio devices. You can change permissions in your device settings; operating-system behavior and available controls vary by device. Changing a device permission does not itself delete data already held by LaDepozit.

7. Recipients and processors

Authorized LaDepozit staff and service providers receive information only as needed for their roles and within the applicable purposes. These include:

Twilio, for voice calling and related communications services, including call audio, call recordings and call-routing information.
Google Firebase Cloud Messaging and Apple Push Notification service, for delivering device notifications and handling push tokens.
Google, when you choose Google sign-in, to authenticate your account.
IT, hosting and technical support providers [NAME OF HOSTING PROVIDER], for operating the service.
Authorities or other recipients where disclosure is required by law or otherwise permitted under applicable law.

Each recipient’s role is determined by its actual activities, and Article 28 GDPR agreements are concluded with processors.

8. Data transfers

As at the date of this version, processing takes place within the European Economic Area (EEA) and no transfers outside the EEA are carried out. Any future transfer outside the EEA must comply with Chapter V GDPR, based on an adequacy decision or appropriate safeguards, including standard contractual clauses and supplementary measures where applicable. Information on safeguards and on obtaining a copy is available at privacy@ladepozit.ro.

9. Security

The Controller applies technical and organizational measures proportionate to the risks, in accordance with Article 32 GDPR:

protected credential storage on the device (Android Keystore-backed encrypted storage on Android; Keychain on iOS);
encrypted connections (TLS) between the app and our services;
authentication for all access, including multi-factor authentication where enabled, and role-based access restrictions, in particular for call recordings;
access logging, backups and periodic review of authorized users;
a procedure for assessing personal data breaches and notifying ANSPDCP without undue delay and, where feasible, within 72 hours of awareness, where Article 33 GDPR requires notification.

No system is completely secure. Report a suspected security incident, lost device or unauthorized access promptly to privacy@ladepozit.ro and to your LaDepozit administrator.

10. Retention and deletion

Call recordings: up to [RETENTION PERIOD] days, with separate preservation only in the justified cases described in section 4. Deletion: automatic.
Call history and call metadata: 2 years after the end of the relationship with the contact, in line with contact and correspondence data in the general GDPR Policy. Deletion: automatic.
Staff accounts and session records: for the duration of the person’s access to the app; deleted when access ends, except data needed for a specific incident, dispute or legal obligation.
Push notification tokens: until you sign out, uninstall the app or the token expires.
IT logs, access and security logs: 12 months. Deletion: automatic log rotation.
Backups: residual copies are removed within 30 days after deletion from active systems and are not used for ordinary processing.

Deletion is normally performed automatically and, where automation is not possible, manually by authorized personnel, without extending the applicable retention periods. Signing out or uninstalling the app does not by itself delete information held on our servers or by our providers. Contact your administrator to request removal of your access to the staff service.

11. Your rights

Under the GDPR you have the right to information (Art. 13–14), access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21), on grounds relating to your particular situation, to processing based on legitimate interest, including call recording. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Requests may be sent to privacy@ladepozit.ro. We verify the identity of the requester through proportionate means and respond without undue delay and no later than one month after receiving the request. Where necessary, taking account of the complexity and number of requests, this period may be extended by two further months; you will be informed of the extension and the reasons within the first month. The right of access includes a copy of your personal data, including recordings of your calls, while protecting the data of other participants.

If you are dissatisfied with our response, you may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or apply to the competent courts.

12. Changes

This policy is reviewed together with the general GDPR Policy, annually or whenever technological, legal or operational changes affect the processing. Significant changes will be published and communicated to app users where applicable.